(base) $root@lnpg \~$ # mkdir -p /db/user_audit

(base) $root@lnpg \~$ # touch /db/user_audit/user_audit.log

(base) $root@lnpg \~$ # chown nobody:nobody /db/user_audit/user_audit.log

(base) $root@lnpg \~$ # chmod 002 /db/user_audit/user_audit.log

(base) $root@lnpg \~$ # chattr +a /db/user_audit/user_audit.log

(base) $root@lnpg \~$ # vi /etc/profile

/etc/profile

复制代码

export HISTORY_FILE=/db/user_audit/user_audit.log
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}")  #### $(id|awk "{print \$1}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >> $HISTORY_FILE'

(base) $root@lnpg \~$ # source /etc/profile

新开窗口做操作，可以看到实时的记录到用户的操作

(base) $root@lnpg \~$ # tail -f /db/user_audit/user_audit.log

2025-10-20 11:57:07 ##### root pts/2 (10.168.20.66) #### uid=0(root) #### source /etc/profile

2025-10-20 11:57:33 ##### root pts/4 (10.168.20.66) #### uid=0(root) #### history|head

2025-10-20 11:57:42 ##### root pts/4 (10.168.20.66) #### uid=0(root) #### pwd

2025-10-20 11:57:49 ##### root pts/4 (10.168.20.66) #### uid=0(root) #### ls

2025-10-20 11:57:58 ##### root pts/4 (10.168.20.66) #### uid=54323(dmdba) #### exit

2025-10-20 11:58:05 ##### root pts/4 (10.168.20.66) #### uid=54323(dmdba) #### free -h

将文件名按日志保存写入：

复制代码

export CURRENT_DATE=$(date "+%Y-%m-%d")
export HISTORY_FILE=/db/user_audit/user_audit_${CURRENT_DATE}.log
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}")  #### $(id|awk "{print \$1}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >> $HISTORY_FILE'


=========================

(base) [root@lnpg ~]# chmod -R 777 /db/user_audit/
chmod: changing permissions of '/db/user_audit/user_audit.log': Operation not permitted
(base) [root@lnpg ~]# ll /db/user_audit/*
-rwxrwxrwx 1 root   root    294 Oct 20 13:32 /db/user_audit/user_audit_2025-10-20.log
--------w- 1 nobody nobody 2347 Oct 20 13:31 /db/user_audit/user_audit.log
(base) [root@lnpg ~]# chown -R nobody:nobody /db/user_audit/
chown: changing ownership of '/db/user_audit/user_audit.log': Operation not permitted

https://chat.deepseek.com/share/x4feonhrk3w1vifbvq

linux系统记录登录用户的所有操作

/etc/profile